OBTAINING CUSTOMER RECORDS FROM SBC/AMERITECH FOR LAW ENFORCEMENT

ASSET PROTECTION

SBC SERVICES SUBPOENA CENTER COURT ORDER BUREAU

AMA TECHNOLOGY CENTER

2

SBC/AMERITECH CUSTOMER RECORDS POLICY

The telecommunications industry is undergoing rapid changes and

transformations. These changes include legal, regulatory, market,

product, and operational issues. Requestors of customer records

need to be cognizant that the availability of information is changing

concurrent with the transformation of our industry. Ameritech

remains prepared to assist Law Enforcement in any legal manner

feasible given the changes in our industry.

3

TABLE OF CONTENTS

SBC/Ameritech Customer Records Policy………………………………….2

SBC/Ameritech Subpoena Contact List……………………………………..4

Non-Emergency Subpoena Services……………………………………… 6

Obtaining Customer Records………………………………………………..6

Emergency Subpoena Service………………………………………………8

Records Kept in the Normal Course of Business…………………………...9

Created Reports……………………………………………………………10

Other Services Provided by Ameitech…………………………………….10 AMA Study………………………………………………………………..11 Examples of Edited AMA Reports………………………………………..13 Annoyance Call Services………………………………………………….15 Glossary……………………………………………………………………16 APPENDIX A Examples of Ameritech Records…………………………………1-4 APPENDIX B Helpful Hints……………………………………………………...20

4

SBC/AMERITECH SUBPOENA CONTACT LIST

SBC SERVICES SUBPOENA CENTER (Requests for Ameritech Records) Mailing Address: 211 S. Akard Street, Rm 1270 Dallas, Texas 75202 Phone: 800-291-4952 Fax: 888-635-6615 Hours of Operation: 8:00A.M. – 4:00P.M. CLIENT SERVICES (Issues needing involvement from SBC Asset Protection) Phone: 800-832-2998 ANNOYANCE CALLS BUREAU (Results on Traps and *57 for Law Enforcement Investigation) Phone: 800-769-4099 Fax: 313-592-3027 COURT ORDER BUREAU (Request for intercepts of voice & data communications and non-consensual trap/trace) Phone: 816-275-1436 Fax: 800-294-9805 AMA TECHNOLOGIES GROUP (Requests for AMA Reports) Phone: 847-248-6961 Fax: 847-248-8329 CINGULAR WIRELESS (Cellular and Wireless) Phone: 866-254-3277 Fax: 866-856-0149

5

NON-EMERGENCY SUBPOENA SERVICE SBC Services Subpoena Center is now located at 211 S. Akard Street, Rm. 1270, Dallas, TX 75202. We can be reached on 800-291-4952 for inquiries and 888-635-6615 for FAX. If you fax a subpoena, please do not mail it unless you have been requested to do so; this may cause an administrative oversight that may delay processing. If the case has been settled, or your investigation needs change and you no longer need records, please cancel your request by calling the Subpoena Control Center. Ameritech operates in the following five states: INDIANA ILLINOIS MICHIGAN OHIO WISCONSIN Ameritech does not provide service in all exchanges within these area codes. Due to increased competition in local telephone markets in Ameritech, it is recommended that the account be verified as being served by Ameritech. This information can be verified on www.directorynet.com. This is not an SBC/Ameritech website. OBTAINING CUSTOMER RECORDS 1. Release of Records is Governed

by Federal Law.

The Electronic Communications Act of 1986 {18 USC 2703 (c) (1) (B)} (Effective January 20, 1987) Subpoenas for telephone company records are subject to the requirements of this act, which prohibits telephone companies from providing customer information to a governmental agency unless that request is made pursuant to either:

- A summons: A notice used to commence a civil litigation.

- An administrative subpoena: Is authorized by statute, a grand jury or trial subpoena.

- A search warrant: A legal document that authorizes a search by the police.

- Court Order: Shows that there is reason to believe that the customer records are relevant to a legitimate law enforcement inquiry.

2. Non-Disclosure Statement

Ameritech will not notify customer whose records have been subpoenaed by legal process. Please include the non-disclosure statement below in your subpoena requests. “Pursuant to an official criminal investigation being conducted by this agency, you are not to disclose the existence of this request. Any such disclosure could impede the investigation being conducted and thereby interfere with the enforcement of the law.”

6

3. Release of Records by Customer Waiver

Customers can request copies of their own records from the Ameritech business office. In this circumstance, an agency does not need to contact Ameritech for the records. The Ameritech Business office number is 800-244-4444. 4. Directory Assistance The SBC Services Subpoena Center will not conduct directory assistance inquiries on behalf of law enforcement agencies, however, can assist with non-published numbers. 5. Time Required for

Response SBC Services Subpoena Center processes more than 60,000 subpoenas, court orders, and other requests for telephone company records each year. Because of this volume, the Subpoena Center requires a minimum of one to two weeks to respond. Please keep this turnaround time in mind. Requests for records on large businesses or other substantial volumes of Toll/MUD calls may require even more time. 6. Overly Broad Requests Requests for “any and all telephone records” with respect to a particular telephone account will delay the request and may result in fees charged to our agency because such

a request is, in most cases, too general. To avoid this, please be as specific as possible in the request. The following is suggested wording when requesting customer records to expedite a request: Pursuant to an official investigation being conducted by (Agency Name), it is directed that Ameritech furnish subscriber information, full and complete copies of MUD & or Toll calls for the entire monthly billing period(s) which include calls between (date) through (date) for the following telephone number(s). 7. Retention of Customer

Records The FCC mandates that Ameritech retain customer records for 18 months. The retention media are stored at various locations and in different formats throughout the Ameritech region. As a result, requests may require as many as three weeks for records to be returned to the SBC Services Subpoena Center. The SBC Services Subpoena Center forwards records received from other Ameritech offices; no original copy is kept at the SBC Services Subpoena Center. Please keep this in mind before making notations on the original copy.

7

8. Unlisted Numbers Unlisted telephone number information will not be disclosed without a subpoena. 9. Customer Information via

Customer Name and/or Street Address

Ameritech’s business records are organized primarily by telephone account number rather than by customer’s name or address. Please consult directory assistance to obtain a customer’s phone number before sending a request to Ameritech. We will provide any current subscriber information found in our date base. Ameritech’s systems are unable to provide past numbers based on customer name and address alone. Alternative methods to obtain LISTED subscriber information: - Reverse Directory

Assistance – can be obtained from your local Ameritech Directory Assistance. Provide the telephone number(s) in question to the operator and if the number is listed you will be provided the name and address of the subscriber.

- Directorynet.com- (www.directorynet.com)-is an Internet based system, which searches by the name, number, or address. (Please note, at this time Directorynet.com is experiencing difficulty with Ohio subscriber information). Additional information on

this service can be obtained by calling Directorynet.com at 1-800-733-1212.

- Fone Finder (www.primeris.com.fonefind/index.php3) - is an Internet based system, which will provide the service provider of a telephone number. By entering the area code and first three (3) digits of the telephone number, Fone Finder will provide the telephone company that handles that exchange.

10. Delivery of Records All records are mailed via the U.S. Postal Service. Emergency requests will be sent via UPS Next Day Air. EMERGENCY SUBPOENA SERVICE An emergency is defined as an imminent threat to life, health, or property.

Records will be released in the absence of paperwork to a representative of the requesting agency when the requesting agency has specifically indicated that the request is an emergency. Emergencies are handled on a 24-hr basis by Client Services at 800-832-2998.

8

RECORDS KEPT IN THE NORMAL COURSE OF BUSINESS Ameritech produces telephone bills in the normal course of business for billing purposes only. Billing cycles are particular to a customer’s telephone number. Call record information is available ten days after completion of the customer’s billing date. Only outgoing long distance calls are listed on these bills if Ameritech is the billing agent for the long distance carrier. Outgoing local telephone call records are available on request. 1. Subscriber Information

(Customer Service Record) – Account name and address is provided. Each request should include the area code (see Section IV).

2. Customer Credit and Billing

Information (Bill Face Page) – Information is provided by the customer at the time the account is established. This information is often unverified and is rarely updated after initial entry on account. Credit and Billing Information consist of:

- Billing Name and Address.

This may not be the same as the listed name and actual location of the telephone.

- Established date of service,

service orders, disconnection.

- Credit information may include: Social Security number, date of birth (DOB),

Can-be-reached number (CBR) and/or employment number, Driver’s License number, and other miscellaneous information.

- A credit history is a

customer’s payment history with Ameritech.

- All information may not be

available on older accounts.

3. Toll Records – Includes long distance calls that are billed to an Ameritech customer’s account. Each customer account has a different billing period.

Types of long distance calls are: direct dialed, operator-assisted, calling card, third number, and collect. Please Note: the long distance provider bills some toll charges directly to the customer. These call records may not be available from Ameritech, and you will have to obtain them directly from the long distance provider.

4. MUD is an acronym for message unit detail. This includes all local calls made to area codes 312, 630, 708, 773, 847, and a portion of 815.

9

CREATED REPORTS Ameritech does not produce the following information during the normal course of business for: - Incoming calls to a particular

telephone number. - Outgoing calls prior to the

billing period. However, these types of calls (unbilled toll) are stored in the Ameritech database for 60 days and a report can be created via an AMA (automated message accounting) tape search. AMA Reports This service (automated message accounting, or AMA) can be used to retrieve outgoing calls prior to bill printing, incoming calls to a particular telephone number or incoming and outgoing calls on a pay phone for a period of 60 days. Obtaining such information requires compelling legal documentation. This can be a very expensive report to produce, and Ameritech will bill accordingly (see Section II). Court Orders for Intercept Service and Ameritech Voice Mail Contact: Marsha Howell Phone: (816) 275-8153 Fax: (816) 275-1436 SBC/Ameritech Court Order Bureau 500 E. 8th Street, Rm. 1302 Kansas City, MO 64106

Handles legal process involving intercepts of voice & data communications and non-consensual trap and trace. OTHER SERVICES PROVIDED BY AMERITECH Annoyance Call Bureau This service helps customers when they receive harassing or annoying calls. For assistance contact (see Section III for additional information):

Customer Line (800) 769-4099 Law Enforcement (800) 769-4094 Fax Number (313) 592-3022 Contact the after-hours Bureau about annoyance calls outside of normal working hours (see Section V for telephone numbers). Customer Name and Address Bureaus (published numbers only) In some locations, Ameritech provides listed customer information via customer Name and Address (CAN) bureaus. These bureaus operate under a waiver by appropriate regulatory or court orders, applicable only to a specific area. Customer information will be provided only in compliance with the Electronic Communications Privacy Act. Michigan………….(900) 628-1234 (313, 248 and 810 area codes only) Illinois……………. (312) 796-9600 (312, 630, 708, 773, 815, and 847 area codes only)

10

AMA STUDY

Automatic Message Accounting (AMA) is the method used by all Ameritech Central Office switches to record billing records. These records are collected on magnetic tapes in the central offices and then forwarded to various data centers where the information is stored for 60 days. The primary use of the 4 to 5 million calls stored per data tapes are to produce customer bills based on billing dates. Other uses include responding to billing inquiries and challenges by inter-exchange carriers (IXC) and customers where the originating and terminating numbers are known. SBC Ameritech Asset Protection’s AMA Technology group handles AMA legal process requests. Legal process for AMA’s should be faxed to the SBC Services Subpoena Center at (888) 635-6615. The AMA Technology group is located at:

2000 W. Ameritech Center Dr, Rm. 2i94 Hoffman Estates, IL. 60196. Main number (847) 248-6961 Fax number (847) 248-8581

Terminating AMA Reports: This report identifies the originating numbers for specific call made to a known terminating number. • Requests may have a narrow timeframe to search. Examples would include bomb

threats, kidnapping, extortion, and fugitive apprehension. • Requests for all incoming calls to a known terminating number with broad time

frame. • Request all incoming calls with no time frame provided. A subpoena requiring a terminating AMA scan will usually use the words incoming calls, special computer study, AMA scan or AMA Study A recommended narrative for legal process requesting incoming calls for a narrow time frame within the 60-day retention period is as follows:

Example a subpoena dated February 15, 2001: Please conduct an AMA Study to identify all calls terminating to telephone number 214 464-XXXX for the dates February 5, 2001 through February 8, 200I, such information to include the names and address of the subscribers to and locations for all incoming calls.

Terminating AMA scans are not performed in the normal course of business at Ameritech, and require a voluminous and burdensome use of resources to comply with the request. Ameritech has established a prevailing rate for compensation based on the number of tapes scanned per day. In Illinois the charge for a terminating scan is $81 per day requested, compared to $18 for Indiana. This is because of the number of data tapes recording information varies per day, per state.

11

Originating AMA Reports: This report identifies outgoing calls from a known number. Types of calls identified include local calls, (regardless if the customer is billed for local usage), DDD (define) long distance, and 800 calls. Originating scans will not identify operator-assisted calls. Like terminating scans these requests can be requested for various time frames.

A subpoena requiring an originating AMA scan will usually contain the words, outgoing calls, special computer study, local calls or AMA Scan. A Recommended narrative for legal process requesting originating calls for a narrow time frame within the 60-day retention period is as follows:

Example a subpoena dated February 15, 2001: Please conduct an AMA Study to identify all calls originating from telephone number 214 464-XXXX for the dates February 5, 2001 through February 8, 200I. Such information to include the names and address of the subscribers to and locations for outgoing calls.

Combining AMA Reports: Reports can be created which includes both originating and terminating records. These reports appear as a single report and are chronological. A recommended narrative for legal process requesting both originating and terminating calls for a narrow time frame within the 60-day retention period is as follows:

Example a subpoena dated February 15, 2001: Please conduct an AMA Study to identify all calls originating and terminating from telephone number 214 464-XXXX for the dates February 5, 2001 through February 8, 200I. Such information to include the names and address of the subscribers to and locations for incoming and outgoing calls.

Understanding the AMA Reports Prior to releasing an AMA report to law enforcement significant editing is required to put the data in an understanding format. As an example, the following is the “raw data” of a phone call from 309-671-3080 to 217-524-8079: AA00625C110C036C0692568C013C0924698C50405C00000C0200000C0C0C0C012C309C6713080C0C00217C5248079C1007445C000001357C02881C50405C1007390C000001411C010C3034C0C1C3C. This message contains 157 characters

12

Examples of an edited report: Originating Report: CALL MEDIA ORIG ORIGINAT TERM TERMIN CONNECT ELAPSED CARR TYPE DATE NPA NUMBER NPA NUMBER TIME TIME IX 006 00/10/28 312 342-16xx 414 264-01xx 08:46:08 1:23:09 006 00/10/28 312 342-16xx 414 264-0xxx 09:25:59 5:30:00 006 00/10/28 312 342-16xx 414 264-12xx 10:46:23 0:40:00 006 00/10/28 312 342-16xx 614 555-32xx 10:47:06 12:00:00 006 00/10/28 312 342-16xx 314 364-xx25 11:00:58 6:36:00 006 00/10/28 312 342-16xx 972 265-12xx 11:39:23 1:01:37:00 Terminating Report: CALL MEDIA ORIG ORIGINAT TERM TERMIN CONNECT ELAPSED CARR TYPE DATE NPA NUMBER NPA NUMBER TIME TIME IX 006 00/11/13 312 263-xx30 608 848-59xx 13:40:50 3:29:01 006 00/11/13 217 345-67xx 608 848-59xx 15:12:16 0:31:22 006 00/11/13 214 721-99xx 608 848-59xx 15:13:58 0:05:33 006 00/11/13 608 263-72xx 608 848-59xx 15:22:17 1:24:06:01 006 00/11/13 608 263-99xx 608 848-59xx 17:17:28 0:25:33 1. Call Type - numeric code that identifies how a call will be billed. This is used

primarily for internal billing purposes 2. Date Media- date of the call by year/month/day 3. NPA & Number (originating) – displays the area code and telephone number where a

call was placed from. 4. NPA & Number (terminating) – displays the area code and telephone number where a

call was placed to. 5. Time Connect – time the call was answered. All times are in military hr/min/sec 6. Elapsed Time – duration of the call hr/min/sec/hundredth sec All AMA Reports are sorted by DATE and then by TIME order when the calls were placed. Emergency Requests for AMA reports SBC Ameritech Asset Protection responds to requests for emergency AMA’s. These requests typically involve incidents of bomb threats, kidnappings, extortion and homicide, which the requesting law enforcement agency has identified as an imminent threat to life. Legal process is not required for these requests if the following conditions exist: • Law Enforcement has the permission of the subscriber • If the time of the call, or a narrow time frame is known

13

Emergency requests must be initiated by contacting SBC Asset Protection Client Services at 800 832-2998. This number can be contacted 24 hours per day 7 days a week. Timeframe for processing AMA legal process AMA results for requests involving two weeks of data, or less, are normally available within 7 business days after the request is received. AMA results for request involving more than two weeks of data (omit - or less) are normally available within 14 business days after the request is received. Emergency requests are normally available within a 6 to 24 hour time period. Records are returned via U.S. Mail, Fax, or E-Mail.

14

Annoyance Call Services

Call Trap/Trace In most cases Ameritech’s Annoyance Call Bureau (AACB) can identify by originating telephone number the source of annoying/harassing telephone calls. Once the customer receives an annoying/harassing call, they should contact their local police department to file a formal complaint. The customer should then provide the AACB with the involved Police department case number, along with the investigating officers name and contact number. The trap is usually active for two weeks. The results are released to the police department and the trap is terminated at the expiration of the trap. Call Trace (*57) Call Trace feature can be activated by dialing *57 (1157 using a rotary dial phone) from the customer’s home telephone number, (only in areas where Call Trace is available). The feature activation is confirmed by a recorded announcement that advises whether or not the trace was successful and gives instructions on how to follow up with the AACB. If successful the details of the calling party’s number, time and date of the calls, are automatically recorded by the AACB. The customer must call the AACB within five days of receiving verification of a successful trace. The AACB hours of operations: 8:00am to 5:00pm, Monday through Friday. The telephone numbers to be used are as follows: Customer Line (800) 769-4099 Law Enforcement Line (800) 769-4094 A $4.00 charge is billed for each successful Call Trace whether the customer pursues with law enforcement or decides not to follow up. If Call Trace is unsuccessful, the customer will be instructed to call the Customer Sales and Service Center @ (800) 244-4444 for other recommendations. No charge applies if a telephone number was not traced. Client Services handles emergency and threatening call traces and can be reached any time at (800) 832-2998. Trace requests to Client Services must emanate from law enforcement only.

15

GLOSSARY Advance Toll Itemized calls (see definition) that are obtained prior to the end of a customer’s normal billing cycle. After Hours Bureau Office that handles emergency calls after normal business hours (5 P.M. through 8 A.M., weekends and holidays). AMA Report A report that captures incoming and outgoing calls that have either been placed, or will occur in the future. With an AMA Study, Ameritech can only go back 60 days into the past, there is a charge, and results are not guaranteed, based upon which company an incoming call may have been placed through. Annoyance Call Bureau Bureau that assists customers, through the process of a Trap (see definition), that are receiving annoying and/or harassing phone calls that are not considered emergency or life threatening situations. Automatic Callback A preexisting feature activated by dialing *69, that redials the last incoming phone call. Bill Face Page Printout that provides customer billing and credit information. Billing Period / Billing Cycle The time period (normally 30 days) in which customer’s monthly charges occur. Billing periods differ based upon the customer’s telephone numbers. BUS (Abbreviation) code, which appears on a customer’s account indicating the class of service as a Business account. Business Office / Customer Care Center- Locations that assist customers with their accounts. This includes ordering records, installing new, moving or changing their service, as well as any billing matters. Open 24 hours a day. Caller ID Feature that identifies incoming caller’s phone number and name on a display unit.

16

Call Screening Feature that blocks incoming calls from up to 10 designated numbers. Call Trace Preexisting feature that attempts to automatically trace the last incoming call by dialing * 5 7. A recording will advise the customer if the trace attempt was successful or not. Carrier A term that refers to another company that “carries” or handles customer’s calls, usually for long distance calls. Cell Sites Provides the Cell site addresses of the cell towers that a customer has utilized. CNAB Customer Name and Address Bureau; provides customer’s name and address information. Computer Study See AMA Study Contact Number Authorized agency number for callbacks. Contracts Customers service agreement. CSBL Customer Service Bill page, same as Bill Face Page. CSR Customer Service Records; provides name and location of a customer’s service, as well as information regarding the type of service. DISC Code that indicates an account is disconnected. Directory Assistance Provides telephone number and location on listed numbers. Emergency An imminent threat to life, health or property. Historic A term that applies to an AMA Study for calls that already occurred in the past.

17

Independent Telephone Company Privately owned telephone companies, not associated with Ameritech. Itemized Call Any type of long distance, or non-directly dialed local call (collect call, calling card call, third number call, operator assisted call, etc.). Live An account that is active or working. MUD Message Unit Detail; any and all local outgoing calls from a subscriber’s telephone number. Non-Disclosure Statement A statement informing Ameritech not to disclose information pertaining to a request. Notes Recordings of transactions that have occurred on customer’s accounts. NTN Indicates there has been a change on a customer’s account to a different or “new” telephone number. Originating Outgoing calls. OTN Abbreviation meaning “Old Telephone Number”; means an account had a previous, different telephone number from the current one. Records Documentation pertaining to customer’s telephone accounts, such as usage and listing information. Retention Length of time Ameritech is required to keep or store customer’s records. 18 months is our “retention period”. Subscriber The person to whom a telephone number is assigned. Terminating Incoming calls.

18

Three Way Calling A feature that allows the originator of a call to bridge another, or third, party, into that call. Time Frame The amount of time it takes Ameritech to respond to a request. Toll Another term for “Itemized Call” (see definition). Trace Procedure to attempt to identify an incoming call, while still in progress. Usually attempted in reference to emergency calls. Trap A computer program activated on an account to record incoming calls, on an ongoing basis, as they occur. Used in harassing or potentially emergency call situations, where identifying the incoming call as soon as possible is a main priority. Unlisted Number A telephone number with one of two degrees of privacy: Non Listed-not in telephone book(s) but disclosed by operator upon request. Non Published-not listed in telephone book(s) and not disclosed by operator. Voice Mail A feature that records incoming conversations if the phone in use, or if not answered. Similar to having an answering machine, but no special equipment is necessary on behalf of the customer. 800 Vendor Check Service that provides the owner, or “vendor” of an 800 number.

19

APPENDIX B

HELPFUL HINTS 1. Include complete return address and contact information on each subpoena. 2. Utilize correct language as outlined in the handbook when serving subpoenas.

3. Faxed copy of subpoena will suffice in lieu of mailed copy.

4. To verify receipt of your subpoena refer to your fax confirmation.

5. The fastest way to send your subpoena is to fax it.

6. Identify what information you need on your target.

7. Request just the information you need.

8. Be specific on time frame required.

9. Request by bills, not dates: From Sept. 2001 thru Present or Current Bill

10. Check publicly available information.

11. Provide accurate information.

12. Verify the telephone number, spelling of names & addresses.

13. Provide a reasonable due date.

-

20

SBC AMERITECHSBC AMERITECH LAW ENFORCMENT LAW ENFORCMENT

SERVICESSERVICES

David J. VogelExecutive Director - Asset Protection

Ameritech - SNET847 248-3745

THE AGENDATHE AGENDA

Obtaining customer billing records kept in the normal course of businessObtaining customer billing records not kept in the normal course of businessElectronic Surveillance, Trap and TraceAMA reportsEmergency ServicesFuture Enhancements

SBC AMERITECH SBC AMERITECH SUBPOENA PROCESSINGSUBPOENA PROCESSINGSBC SERVICES SUBPOENA CENTER– CENTRALIZED IN DALLAS JAN. 2001– SEVEN EMPLOYEES SERVING THE

AMERITECH REGION– STATE OF THE ART - LEADERS IN

PROCESSING RECORDSSBCAMERITECH

HOW TO SERVE US?HOW TO SERVE US?SBC AMERITECH

CUSTODIAN OF RECORDS211 S. AKARD ST. - ROOM 1270

DALLAS, TEXAS 75202TELEPHONE 800 291-4952 OR 214 464-8331

FAX 888 635-6615 OR 214 464-9502

BEFORE MECHANIZATION

AFTER MECHANIZATIONAFTER MECHANIZATION

SUBPOENA FAXED/STORED ON LINEAUTOMATED CORRESPONDENCERETRIEVES RECORDS FROM VARIOUS SOURCES

LEED

Records Kept in the Normal Records Kept in the Normal Course of BusinessCourse of Business

RETENTION OF RECORDS RETENTION OF RECORDS

EXCEED FCC REQUIREMENTS OF 18 MONTHSSUBPOENA CENTER DOES NOT KEEP COPY OF RECORDS PROVIDED– MAKE A COPY BEFORE YOU WRITE ON THEM IF THEY

WILL BE NEEDED IN COURT

DISCONNECTED ACCOUNTS – WE ONLY KEEP RECORDS ON DISCONNECTED

ACCOUNTS WITH AN OUTSTANDING BALANCE– WE WILL NEED THE TELEPHONE NUMBER AND THE

FULL ADDRESS WHERE THE SERVICE WAS LOCATED

RECORDS NORMALLY RECORDS NORMALLY MAINTAINEDMAINTAINED

CREDIT AND BILLING INFO– LISTED/BILLED NAME AND ADDRESS– SOCIAL SECURITY NUMBER– ESTABLISHED DATE OF SERVICE– PLACE OF EMPLOYMENT– REFERENCES– SPOUSE– PAYMENT HISTORY– DOES NOT INCLUDE TOLL RECORDS

RECORDS NORMALLY RECORDS NORMALLY MAINTAINEDMAINTAINED

TOLL RECORDS– DIRECT DIALED– OPERATOR ASSISTED– CALLING CARD– COLLECT– THIRD NUMBER

LOCAL CALL DETAILS (MUD)– ILLINOIS AND WISCONSIN ONLY

RECORDS NORMALLY RECORDS NORMALLY MAINTAINED (CON’T)MAINTAINED (CON’T)

NON PUBLISHED INFORMATIONSEARCH BY ADDRESSLONG DISTANCE CARRIER INFORMATION

RECORDS NORMALLY RECORDS NORMALLY MAINTAINEDMAINTAINED

CUSTOM CALLING FEATURESCALL WAITINGCALL FORWARDINGTHREE WAY CLNGSPEED CALLINGCALL BLOCKERCALLER ID

CALL RETURNCALL TRACEPERSONALIZED RINGPRIORITY CALLSELECTIVE CALL FORWARDING

VOICE DIAL

LEGAL PROCESS CONTENTSLEGAL PROCESS CONTENTS

THE FOLLOWING MUST BE CONTAINED IN THE BODY OF YOUR LEGAL PROCESS– FULL DESCRIPTION OF INFORMATION REQUESTED

COMPLETE TELPHONE NUMBER INCLUDING AREA CODETOLL, LOCAL CALLS, SUBSCRIBER, CREDIT, CUSTOM CALLING FEATURESTIME FRAME

LEGAL PROCESS CONTENTSLEGAL PROCESS CONTENTS

THE FOLLOWING MUST BE CONTAINED IN THE BODY OF YOUR LEGAL PROCESS– HOW SHOULD RECORDS BE PROVIDED

COURT APPEARANCE MAILED OR FAX RECOMMENDED WORDING: IN LIEU OF APPEARNACE RECORDS MAY BE MAILED TO:NAME OF OFFICER, FULL ADDRESS AND ZIP CODE, FAX NUMBER AND CONTACT FOR REQUESTING OFFICER

– CASE NUMBER– ADDRESS THE SUBPOENA TO CUSTODIAN OF

RECORDS SBC AMERITECH

LEGAL PROCESS CONTENTSLEGAL PROCESS CONTENTS

NON DISCLOSURE STATEMENT– DOESN’T APPLY TO GRAND JURY SUPOENAS– WE MUST NOTIFY OUR CUSTOMER IF THE NON

DISCLOSURE STATEMENT IS NOT IN THE SUBPOENA– EXAMPLE: YOU ARE REQUESTED NOT TO

DISCLOSE THE EXISTENCE OF THIS REQUEST. ANY SUCH DISCLOSURE COULD IMPEDE THE CRIMINAL INVESTIGATION BEING CONDUCTED AND THEREBY INTERFERE WITH THE ENFORCMENT OF THE LAW

LEGAL PROCESS CONTENTSLEGAL PROCESS CONTENTSYOUR FAX TRANSMITTAL SHEET SHOULD CONTAIN THE FOLLOWING– REQUESTING AGENCY AND ORIGINATING

OFFICERS NAME AND CONTACT NUMBER– SUBJECT OF THE FAX– ORIGINATORS FAX NUMBER– BRIEF DESCRIPTION OF COMMUNICATION FAXED– PLEASE DON’T CALL THE SUBPOENA CENTER TO

CHECK ON THE DELIVERY. THIS WILL NOT SPEED UP PROCESSING. YOUR TRANSMITTAL CONFIRMATION WILL SERVE AS PROOF OF DELIEVERY

RECOMMENDED WORDINGRECOMMENDED WORDINGSUBSCRIBER/BILLING/CREDIT ONLY

PLEASE PROVIDE BILLING AND SUBSCRIBER INFORMATION FOR THE FOLLOWING NUMBER(S) XXX XXX-XXXX

SUBSCRIBER/LOCAL/LONG DISTANCEPLEASE PROVIDE SUBSCRIBER INFORMATION ANDRECORDS OF LOCAL (IL. AND WISC) AND LONGDISTANCE CALLS FROM AND TO (MONTH & YEAR) OR THROUGH THE CURRENT BILL (PREFERRED) FORTELEPHONE NUMBER(S) XXX XXX-XXXX

WHEN WILL I GET MY WHEN WILL I GET MY RECORDS??RECORDS??

MAILED WITHIN FIVE DAYS– CUSTOMER MONTHLY BILLS WILL BE EXACT

COPIES OF THE ORIGINAL BILLS

ARCHIVED RECORDS - ONE TO TWO WEEKSLARGE REQUESTS -RETURN TIME WILL VARY EMERGENCY SUBPEONA– CALL FIRST – NOTE THE EMERGENCY ON THE COVER SHEET– NATIONAL THREAT NOTE IN THE NARRATIVE

HELPFUL HINTSHELPFUL HINTSBE AN EDUCATED CONSUMER– IDENTIFY WHAT INFORMATION YOU NEED ON YOUR TARGET

REQUEST JUST THE INFORMATION YOU NEED. YOU CAN ALWAYS REQUEST MORE LATER– NEED JUST SUBSCRIBER AND CREDIT – NEED ALL RECORDS TO INCLUDE

SUBSCRIBER, BILLING CREDIT18 MONHTS WORTH OF LOCAL AND LONG DISTANCEORIGINATING AND TERMINATING AMA REPORTS

– BE SPECIFIC ON TIME FRAME REQUIREDREQUEST BY BILLS NOT DATES: FROM SEPT. 2001 THRU PRESENT OR CURRENT BILL

– THIS WILL EXPEDIATE YOUR RECORDS

HELPFUL HINTSHELPFUL HINTS– CHECK PUBLICLY AVAILABLE INFORMATION

IT COULD BE AT YOUR FINGERTIPS– http://www.primeris.com/fonefind/– http://www.directorynet.com/– SBC Ameritech Directory Assistance

IT COULD BE ANOTHER CARRIERS ACCOUNT– ILLINOIS ALONE HAS 99 LOCAL PROVIDERS WITH

OVER ONE MILLION ACCESS LINES

– PROVIDE ACCURATE INFORMATION COMPLETE ADDRESS, ST., AVE., LANE, ETC., APT, CITY, STATE AND ZIP CODEVERIFY THE SPELLING ON NAMES AND ADDRESSES ARE ACCURATEVERIFY THE TELEPHONE NUMBER

– PROVIDE A REASONABLE DUE DATE

Records Records Not Not kept in the kept in the Normal Course of Normal Course of

BusinessBusiness

AMA RECORDSAMA RECORDSAutomatic Message Accounting (AMA) is the method used by all Central Office switches to record billing records. These records are collected on magnetic tapes in the offices then forwarded to various data centers where they are stored in Data Silos. The data on the tapes is used to produce customer bills based on billing dates. Other uses include responding to billing inquiries and challenges by IXC and customers where the originating and terminating numbers are known. Each Silo stores up to 4850 tapes. Each tape contains data on between 4-5 million calls.The billing tapes are kept for 60 days then the data deleted and the tape recycled back to the central offices.

AMA REPORTSAMA REPORTSSERVICE OF PROCESS - SBC SERVICES SUPBOENA CENTER (SAME AS CUSTOMER BILLING RECORDS ) FAX 888 635-6615The Dallas group forwards AMA requestsAMA reports are handled by AMA Technology Group, a part of SBC Ameritech Asset Protection.

Main number 847 248-6961Fax number 847 248-8329

AMA RECORDSAMA RECORDSTERMINATING REPORT– Identifies originating number for calls made to a known

number.•

Requests may have a narrow time frame to search. Examples would include bomb threats, kidnapping, extortion, and fugitive apprehension.

•

Requests all incoming calls to a known terminating number with broad time frame.

•

Request all incoming calls with no time frame provided. – A subpoena requiring a terminating AMA scan will usually

use the words incoming calls, special computer study or AMA Scan.

AMA REPORTSAMA REPORTSRecommended narrative for legal process requesting incoming calls for a narrow time frame within the 60-day retention period. Example a subpoena dated February 15, 2001: Please conduct an AMA Study to identify all calls terminating to telephone number 312 464-XXXX for the dates February 5, 2001 through February 8, 200I, such information to include the names and address of the subscribers to and locations for all incoming calls.

Terminating AMA scans are not created in the normal course of business and are considered voluminous and burdensome. Ameritech has established a prevailing rate for compensation based on the number of tapes scanned per day. In Illinois the charge for a terminating scan is $81 per

AMA REPORTSAMA REPORTSOriginating AMA Reports:Identifies outgoing calls from a known number. – Data includes local, long distance and 800 calls– Not operator assisted calls

A subpoena requiring an originating scan will usually contain the words, outgoing calls, special computer study, local calls or AMA Scan.Recommended narrative for legal process requesting originating calls for a narrow time frame within the 60-day retention period. Example: A subpoena dated February 15, 2001: Please conduct an AMA Study to identify all calls originating from telephone number 214 464-XXXX for the dates February 5, 2001 through February 8, 200I. Such information to include subscriber information for numbers identified in the study.

AMA REPORTSAMA REPORTSCombining AMA Reports:Reports can be created which includes both originating and terminating records. These reports appear as a single report and are chronological by date and time.Recommended narrative for legal process requesting both originating and terminating calls for a narrow time frame within the 60-day retention period. Example: A subpoena dated February 15, 2001: Please conduct an AMA Study to identify all calls originating and terminating from telephone number 312464-XXXX for the dates February 5, 2001 through February 8, 200I. Such information to include the names and address of the subscribers to and locations for incoming and outgoing calls.

AMA REPORTSAMA REPORTSUnderstanding the AMA Reports

Prior to releasing an AMA report to law enforcement significant editing is required to put the data in an understanding format. Example: raw data contained on one call. Phone call: 309-671-3080 to 217-524-8079:– AA00625C110C036C0692568C013C0924698C504

05C00000C0200000C0C0C0C012C309C6713080 C0C00217C5248079C1007445C000001357C02881 C50405C1007390C000001411C010C3034C0C1C3 C.

– This message contains 157 Characters

AMA REPORTSAMA REPORTSExamples of an edited report:

Originating Report:**1*****2***********3******Top of Data**4***********5*********6*****TYPE DATE NPA NUMBER NPA NUMBER TIME TIME

CARR Originate Terminate connect elapsed

006 00/10/28 312 342-16xx 414 264-01xx 08:46:08 1:23:09 006 00/10/28 312 342-16xx 414 264-0xxx 09:25:59 5:30:00 006 00/10/28 312 342-16xx 414 264-12xx 10:46:23 0:40:00 006 00/10/28 312 342-16xx 614 555-32xx 10:47:06 12:00:00 006 00/10/28 312 342-16xx 314 364-xx25 11:00:58 6:36:00

AMA REPORTAMA REPORTTerminating Report:**1*****2***********3******Top of Data**4***********5*********6*****TYPE DATE NPA NUMBER NPA NUMBER TIME TIME

CARR Originate Terminate connect elapsed

006 00/11/13 312 263-xx30 608 848-59xx 13:40:50 3:29:01 006 00/11/13 217 345-67xx 608 848-59xx 15:12:16 0:31:22 006 00/11/13 214 721-99xx 608 848-59xx 15:13:58 0:05:33 006 00/11/13 608 263-72xx 608 848-59xx 15:22:17 24:06:01 006 00/11/13 608 263-99xx 608 848-59xx 17:17:28 0:25:33

AMA REPORTSAMA REPORTSEmergency Requests for AMA reportsSBC Ameritech Asset Protection responds to requests for emergency AMA’s. These requests typically involve incidents of bomb threats, kidnappings, extortion and homicide, which the requesting law enforcement agency has identified as an imminent threat to life. This service is free and legal process is not required if the following conditions exist:

•

Law Enforcement has the permission of the subscriber•

If the time of the call or a narrow time frame is known

Emergency requests must be initiated by contacting SBC Asset Protection Client Services at 800 832-2998. This number is available 7 X 24.

AMA REPORTSAMA REPORTSTimeframe for processing AMA legal process– AMA results for request involving two weeks of data or

less are normally available 7 business days after the request is received.

– AMA results for request involving more than two weeks of data or less are normally available 14 business days after the request is received.

– Emergency requests normally are available within a 4 – 24 hour period.

– Records can be provided via U.S. Mail, Fax or E-Mail.– E-Mail is preferred

WIRELESS SUBPOENASWIRELESS SUBPOENAS CINGULAR WIRELESSCINGULAR WIRELESS

FORMED IN 2000 BY COMBINING SBC MOBILE, CELLULAR ONE AND BELL SOUTH MOBILITYSUBPOENA CONTROL CENTER

CUSTODIAN OF RECORDS1801 VALLEY VIEW LANE

FARMERS BRANCH, TX 75234MAIN NUMBER 866 254-3277FAX NUMBER 866 856-0196

WIRELESS RECORDS KEPT WIRELESS RECORDS KEPT IN THE NORMAL COURSE IN THE NORMAL COURSE

OF BUSINESSOF BUSINESS

AIRTIME/CALL DETAIL RECORDSSUBSCRIBER INFORMATIONPAYMENT INFORMATION

FEATURESACCOUNT STATUSCELLULAR SERVICE CONTRACT

WIRELESS RECORDS NOT WIRELESS RECORDS NOT KEPT IN THE NORMAL KEPT IN THE NORMAL COURSE OF BUSINESSCOURSE OF BUSINESS

UNBILLED CALL DETAIL RECORDSCELL SITE/LOCATION INFORMATIONTERMINATING NUMBER

COURT ORDER REQUIRED FOR THIS INFORMATION

Emergency Services Provided Emergency Services Provided by SBC Asset Protectionby SBC Asset Protection

Emergency ServicesEmergency ServicesSBC Asset Protections CLIENT SERVICES group

provides 7 X 24 assistance to emergency requests of law enforcement. – Contact number is 800 832-2998– Located in Dallas, Client Services handles all

incoming calls to Asset Protection enterprise wide

Emergency ServicesEmergency ServicesUpon lawful demand involving an imminent threat to life Client Services will provide the following services – Subscriber information (published or non published)

based on name, number or address

– Emergency AMA requestnormally associated to kidnapping, bomb threats (imminent threat), extortion or homicide

– Emergency trap and trace (customer consent is required)

These services are provided at no cost and in most cases legal process is not required.

INTERCEPTION OF VOICE INTERCEPTION OF VOICE AND DATAAND DATA

NON CONSENTUAL TRAP NON CONSENTUAL TRAP AND TRACEAND TRACE

COURT ORDER BUREAUCOURT ORDER BUREAU

LOCATED IN KANSAS CITY MO.– HANDLES ALL 13 SBC STATES

SBC COURT ORDER BUREAU500 E. 8TH ST.

ROOM 1302KANSAS CITY, MO. 64106

MAIN NUMBER 800 813-6442FAX NUMBER 800 294-9805SUPERVISOR 816 275-1436

COURT ORDER BUREAU COURT ORDER BUREAU INTERCEPTION OF VOICE AND DATA COMMUNICATIONS (TITLE III AND PEN REGISTERSNON CONSENTUAL TRAP AND TRACESTORED VOICE MAIL MESSAGESCALL FORWARDING CHECKSSPEED CALLING CHECKSCALL BLOCK CHECKS

Future Enhancements to Future Enhancements to Customer ServiceCustomer Service

Restricted Web-Site for Law Enforcement regarding all services provided by SBCAbility to limit the AMA scans to a geographic area instead of state wide– E-Mail delivery option

– significant reduction in cost– increased in turnaround time

LEED/ AIMS– mechanized system to retrieve subscriber and

credit information

QUESTIONS???QUESTIONS???

AssetProtection

Investigations

CourtOrder

Bureau

InternetLegal

Process

CingularWireless

Court OrderBureau

LegalProcessCenter

Annoyance Call Bureau

CorporateFraudCenter

E-911 Resolution

Center

CingularWireless

Legal Process Center

Contact Numbers 800-807-4205 800-813-6442 210-246-8611 800-635-6840 800-291-4952 800-769-4094 800-438-5678 888-424-3911 800-635-6840Services:

Trap (Consensual)Trap (Non-Consensual)Calling Card FraudSubscriber Information(Wireless)Subscriber and Toll Records, AMA searchesHostage/Barricade

911 Listings

Emergency ListingsLive TracesInternalInvestigationsCriminal Acts(Company Victim)VIP TrapsEmergency AMAPen RegistersFeature ChecksUndercover LinesWireless Pen Register,TrapsInternet SubscriberInformationVoice MailThis information applies to subscribers of the AT&T family of companies in the AT&T Midwest region. LAW ENFORCEMENT USE ONLY.

AT&T Midwest Law Enforcement Reference Guide

Rev. 09/18/06

Introduction and Overview Legal Process Center E-911 Resolution CenterFax requests to: 248 552-3201 Main number: 888 424-3911

The following informaton is intended to provide law Information/Status: 800 291-4952 This group handles all calls from E-911 dispatchers for subscriberenforcement a reference guide to assist in contacting Mailing address: information or on-line traces. the appropriate organization within AT&T. The AT&T AT&T Services Subpoena CenterMidwest region includes areas in Illinois, Indiana, Michigan, One SBC Plaza, 10th Floor Corporate Fraud CenterOhio, and Wisconsin. The information provides a brief 208 S. Akard Fraud referrals: 800 438-5678description of each department's responsibilities as well Dallas, Texas 75202 Lost/Stolen Calling Cards: 877 722-2251as contact and fax numbers. Please note that this The legal process group serves as the custodian of AT&T Charges on credit cards: Refer customer to their credit card co.information applies solely to customers of AT&T. records for AT&T. They are responsible for The Corporate Fraud Center (CFC) detects and prevents telephone processing requests from law enforcement for fraud. These issues include calling card fraud, theft of identity, and

telephone records retained in the normal course of other prevalent fraud schemes. The CFC also educates customersAsset Protection - Investigations business. These records typically include about telephone fraud. Identity theft is the most common reason forMain number: 800 832-2998 subscriber, billing, and toll information, plus AMA law enforcement involvement.

number searches for customers of AT&T. This dataAsset Protection, formerly known as corporate security, is provided by legal process only. Emergency AMA AT&T Internet Serviceshas the primary responsibility for internal investigations requests are processed through Asset Protection at Main number: 210 246-8611within AT&T. They are responsible for investigating 800 832-2998. For AMA status, 847 248-6961. Fax number: 210 246-8699crimes where AT&T is the victim. Asset Protection AT&T Internet Services Legal Department receives and processesinvestigates and/or coordinates all company efforts Annoyance Call Bureau valid legal process for IP address and subscriber information. Thispertaining to the protection of company personnel, team also accepts requests for preservation of records pursuant toproperty, and other assets from assault, theft, fraud, Main number: 800 769-4099 Title 18, Section 2703, by fax, mail, or personal service. This includesmalicious damage, or other criminal acts. service for companies previously known as:

The Annoyance Call Bureau assists customers with Southwestern Bell InternetCourt Order Bureau harassing, obscene, and threatening telephone SNET Internet ServicesMain number: 800 813-6442 calls. Telephone subscribers will be required to Ameritech Interactive Media ServicesFax number: 800 294-9805 have a law enforcement case number before a trap Nevada Bell Internet

is established. Pacific Bell InternetThis organization is responsible for processing law Note: Call trace results are only released to the Address requests to:enforcement requests for court ordered services such investigating agency. The released information will AT&T Internet Servicesas court ordered traps, traces, and other number include name, address, and telephone number of ATTN: Custodian of Recordssearches; pen registers (circuit coordination); requests suspect(s) and the dates/times of the calls placed. 1010 N. St. Mary's, room 1430for voice mail / messaging checks; telephone service San Antonio, Texas 78215feature checks; undercover line provisioning; intercepts The Asset Protection Dept. handles call trace needs(wireline and DSL); emergency requests for assistance for bomb threats, hostage situations, and Cingular Wireless Legal Process & Court Ordersin situations of imminent danger of death or bodily injury; Presidential or dignitary visits. The investigating Main number: 800 635-6840and national security letters. agency can coordinate their request through the Fax number: 888 938-4715NOTE: Many of these services require a fee. Asset Protection Dept. This organization is the point of contact for law enforcement to obtain information about a Cingular Wireless subscriber. They serve as the

Custodian of Records for subscriber information or calling detail.

Rev. 09/18/06